5
CVSSv2

CVE-2021-26690

Published: 10/06/2021 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 447
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

debian debian linux 9.0

debian debian linux 10.0

fedoraproject fedora 34

fedoraproject fedora 35

oracle instantis enterprisetrack 17.1

oracle instantis enterprisetrack 17.2

oracle instantis enterprisetrack 17.3

oracle enterprise manager ops center 12.4.0.0

oracle zfs storage appliance kit 8.8

Vendor Advisories

Several vulnerabilities have been found in the Apache HTTP server, which could result in denial of service In addition the implementation of the MergeSlashes option could result in unexpected behaviour For the stable distribution (buster), these problems have been fixed in version 2438-3+deb10u5 We recommend that you upgrade your apache2 packa ...
A flaw was found in Apache httpd The mod_proxy_wstunnel module tunnels non-upgraded connections (CVE-2019-17567) A flaw was found in HTTPd In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows The highest threat from this vulnerability is to system availability (CVE-2020-13938) A flaw was found In Apache httpd ...
A flaw was found in Apache httpd The mod_proxy_wstunnel module tunnels non-upgraded connections (CVE-2019-17567) A flaw was found in HTTPd In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows The highest threat from this vulnerability is to system availability (CVE-2020-13938) A flaw was found In Apache httpd ...
A NULL pointer dereference was found in Apache httpd mod_session The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability ...
In Apache HTTP Server versions 240 to 2446, a specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> CVE-2021-26690: Apache httpd: mod_session NULL pointer dereference <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From ...